The Model Writes, the Data Stay: Architecture and Evaluation Plan for Governed LLM Analysis in a Trusted Research Environment

Status. This concept note describes proposed functionality. The core of TRACE (Trusted Research Access & Collaboration Environment) is in operation, and its Data Transformation process is under evaluation. The orchestration layer, its controls and the AI-use record described here have not been built or evaluated, and the note reports no pilot results. It has not been peer reviewed. Abstract Clinical researchers already use language models in research and publishing, and healthcare staff report using AI tools their institutions have not approved. Approving a tool does not govern what it produces: generated code can reach patient data, leak information through feedback to the model or compute the wrong thing. We propose a governed orchestration layer inside a trusted research environment (TRE) that extends code-to-data practice [1, 2] to code written by language models, built on three principles. First, code generation is separated from access to patient records. External models such as Claude or ChatGPT see the user's instructions and only what each study's data owner (its principal investigator, sponsor or both) allows: at most the data dictionary, installed packages, published literature and sanitized results from runs on stand-in data. Stand-in data are artificial substitutes for the original records that never leave the TRE: dummy data generated from the data dictionary or a synthetic version of the study's records. By design, external models never see patient records or receive automated feedback from runs on them; only a local model inside the TRE may see the original records. Second, scientific validity is judged separately from data protection: before publication, researchers can request a statistical review of whether the cohort definition, methods and their implementation fit the study question and analysis plan. Third, a tamper-evident AI-use record, independent of the model provider, documents models, code, data version, the basis of consequential decisions and review status for work done through the system. Close prior systems return query results or error messages to the model [3, 4, 5]. The TRE, TRACE, is in operation [6]; the layer is a proposal. A staged pilot will test whether the synthetic version, compared with dummy data, helps code run on the original records at the first attempt, and will assess analytical correctness and the AI-use record separately.